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AOtoNumbec 
DatsfTime 
0(te/T&ne 
DatefTime 
Text 
Taxt 
Text 

Test ^ 

Text 

Text 

Text 

Test 

Text 

Text 

Text 

Text" 
Tea* 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 
Text 



A antcfje (ressage record msnber 
(■tessage armat data aid ttne 
Message to be deSvenwi on thsdate 
Message to be dehwed at this time 

Direct^ natrs whew deWfeid (nfo-matEon about 5JJseflA ts found 
Sander's userd (encopted) 
Serster's password (encrpeed) . 
Sender's auchoreabori code fenmgted). . . 
Sendee Regular e-nnai 
' Sender's. Mobfe Phone 
Ser^s Bore Phone 
Sender's Work Prions 
Sender's PaSwPsn 

Sender's Pager H«Jem Number „ - - - 

Sender's Pager 
Sender's Fas fitimber 
Sender's Pa&n Pfct e^maS 
Sender's Future t^ssagsng Dewe 1 

Sender's Future Ptessagrig Device 2 . - - 

Sender's fUue Mess^ Device 3 
DeSbnatoonUserld . - 

Dhsctcry none where detaSed inform**! about D.UseUd e remits 
Oastevatwo Regular e-maS 
DesfanaEH^ Mahfe Phone 
Desbnatton Bona Phone 
mWotV Phone 
Psn 



Destfri*cii Ps^er Modem ftoafcs' 
Destoafooft Pager e^ai 
r**tir*™ fax Number 
DeSBnafeon Pain Pfat e-rosS 





™SO PPEM 

U SOJHH 
£ SO JOT 
^ StartfntftaeeSo^ 
^ Standard^ 



it tehwBS phone 



Test 
Text 




Status of message sent to workphone 
Status of message s«* to pager _ - - - 

Status of message sent to fax nacriw 
Status of nwsssage sent to pAn pSot 
Status«f massage sent to future dewca 
Status af msssags se*4 to future dews 
Status of message set* to ftAure devrce 
M»l Voice or sound fib 
Standard (fixed) Text-to-speech message 
Hessage - - 

VWce Recorded t*fesage 
Somd part of the message 

Flatted messsge.ffe such as m WSD, Him t etc formatted files 
' Graphics part dr the message 
Video part of the inessage 
Message for fttoreinessasfcfl devtce 1 
Massage for fyftffffiwsssgstg devra 2 
ffessage for futurenwssaprig device 3 

5chedtiedDwt^Ksn2«w _ - - 

Sdwdufed Desbnabon Datsand Tims 

Cwrtnwnd text 

Corflroarai to execute on this t»st 

Escatoc*. CMfc, l=Yes, 2=5end to a!i raging de*c« at orce 
fttteTipt sscatoor in these many seconds 
Retry escalation these many W«s 
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FIG. 2 



User id: 5HWI3988 
Password: XXXXXXXX 



S^SSo- Ho!Sep!one=21W998765, E«ail= S a,™als e e« S gtech.co B , Fax=9729991234, 
¥£Hl- Io?krh^e"2ir 8 887766, p a ger=123456789<» a iphapage.ltL n dfelt. C on 



FIG. 3 



i Fvop\z EXectr onxc Hessaging Engines 
Subject: An important alert 

VJhen responding back to this message via the Remote Command Execution (RCE), please 
iuse the following message record number: 7688^533 

This message ms sent to: 

MobilePhone=21%9998765 f Eiaail-sanualsSeras gtech.com, Fax=972999123i# s 
^orkPhone=21^S88?766 , Pager=123**56789a@alphapage .Uindfelt.coro 

j Server SRU001 is not functioning properly. Please check as soon as possible 
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% Microsoft Access - {Commands : Table] 




Unique record number ^ , _ 

Userid authorized to issue command 
Name of the person owning this Userid 
Password of the userid 

Authorization code to match before command can be accepted 
A unique number corresponding to a command in the table 
Location / path where the command can be Found on the host 
Host where the command is to be executed 



Long Integer 
"Increment 



V. Yes (No Duplicates) 
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^ Microsoft Access - JCbmmantts: ; Table] 



1 54441388S 


SARjfV 




3B7654321 


2 544413988 


sanjiv 




387654321 


3 544413388 


SANJIV 


XXXX>0G0£ 


387854321 


4 544413933 


SANJIV 




387654321 


5 654783922 


NEETU 




021234587 


6 654789922 


NEETU 


wmmw 


021234567 


7 654789922 


NEETU 




021234567 


8 854789922 


KEETU 


wwwww 


021234587 


3 25S90G781 


3HWUM 


ABCDEF 


'223344556 


10 258OT781 


SHiVUM 


ABCDEF 


223344556 


11 258900781 


SHIVUM 


ABCDEF 


223344558 


12 256300781 


SHIVUM 


r ABCDEF 


22334455S 


13 97531 TOT 


' ken 


NKAAKN 


131284131 


17 375317680 


NEIL 


NKAAKN 


131284131 


18 375317B80 


&EIL 


HKAAKN 


131284131 


19 375317680 


NEIL 


NKAAKN 


131284131 
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1 C \RCE\Biag1 exe 

2 C \RCBDiag2 exe 

3 C\RCE\RPIXexe 

4 C'\RCE\Reboot exe 

1 CARCBDiag1.exe 

2 C.\RCE\Diag2 exe 

3 C\RCE\RP7X.exe 

4 C \RCE\Reboot exe 

1 C\RCaDiag1.exs 

2 C \RCE\Diag2 eae 

3 C'\RCE\RPTXeKe 

4 C VRCBReboci exe 
1 D:\RCE2\Cmd1 ese 
2D\RCE2\DfagCMD2 

3 C\RCE2\Alert exe 

4 C-\RCE\Rebaot exe 
0 



SRV0G1 
SRV001 

" SRV002 
SRVD02 

' SRV001 
SRV001 
SRV0G2 
SRV002 

SRV001 
SRVGQ2 
SRYQQ2 
SRVQG1 
ESRV001 
SRVQ82 
SRV0Q2 



FIG. 6 
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Fig_?_S ample J N I JFile M - Notepad 



[DTE_Seruer] 

DTE-1J5eruer=216.87.148.218 
Port1=1 881, 1882 
DTE-2_Seruer=216. 87 .1*18.211 
Port1=1 881, 1882 
DTE-3„Seruer-216 -87 .148-212 
Port2=1 881, 1882 



[flutomatic_Escalation] 

Escalatian_J)einLce_1=Fax 

EscalationJ&eviceJ^Etuail 

EscalationJtevice_3=Pager 

Escalation_DeMice3=t1otjilePhone 

Escalation J)evice_5=yorkPhone 

Escalation_Deuice_6=ParaPilot 

EscalationJ>eviee_7*lloroePhQne 

Esealation_Detfice_8=FutureJ)euice 

[ IntelligentDecisionHaking] 

flutonaticHakeupTimeComputation^OH 

flutomaticTineZoneCoiaputation=ON 

[Database] 

Database=C :\apeld2\BTE_Client .nidb 

[ProcessRecs] 
Retr-ies=3 
DelBecs=1 
Interual.^68 

[License] 

Key=EMSG8888-BR81K2PSHEIC"12/31/2881-11228EHG 

[Logging] 
Hode=NORMAL 

[Reports] 

REHail-SamWals2888l3ya!ioo .con 
ftuto8ep-N 



FIG. 7 
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Fi9_8_S ampleJE -mail_R CE . t xl - Notepad 



To: EHME-RB@eiqsgtech.com 
Front: saiQwals@ensgtech.com 
Subject: RCE response back 

Userid: 54*413988 
Password: XXXXXXXX 
ftuthCode: 987654321 
MsgRecNun: 76884533 
Command: 2 

Issuing command 2. Intend to run Diag2 on SRU881. 
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*^ Microsoft Access - fDirectoty : Table] 
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